telnyx-mpp-payment
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and execute the@stripe/link-cli(version 0.11.0) andmppx. Stripe is a well-known service, andmppxis a tool required for the skill's primary purpose of handling Telnyx Machine Payment Protocol transactions. - [COMMAND_EXECUTION]: The skill utilizes
curlandnpxto execute commands that interact with the Telnyx API (api.telnyx.com) and process payment challenges. These operations are essential for the skill's functionality and are performed using secure practices such asumask 077andmktempfor handling sensitive response data. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of HTTP 402 payment challenges, creating a potential attack surface if the provider's endpoint were to return malicious content.
- Ingestion points: Payment challenge headers and body retrieved from
api.telnyx.comare saved to files (CHALLENGE_HEADERS,CHALLENGE_BODY) and passed to CLI tools. - Boundary markers: None identified in the prompt instructions for the CLI inputs.
- Capability inventory: The skill uses
curlfor network requests andnpxfor executing payment processing logic vialink-cliandmppx. - Sanitization: The skill relies on the internal logic of
@stripe/link-cliandmppxto validate and process the challenge strings correctly.
Audit Metadata